ASD's ISM now says every AI agent gets its own identity and goes on a register

2026-09-10 · re: Information security manual: September 2026 changes (ASD's ACSC)

The Australian Signals Directorate’s September update to the Information Security Manual adds seven controls for AI agents, and they are about identity, not intelligence. Under ISM-2157 an agent acting for a person can never hold more than that person holds, whatever the task grants it.

The four worth printing, in ASD’s words:

ISM-2133: “a unique identity that is distinct from the user accounts of personnel and the identities of other AI agents”.
ISM-2135: the register holds “its unique identifier; its owner and business purpose; […] and the tools, permissions and data repositories it can access”.
ISM-2157: an agent’s tools get “effective permissions limited to the minimum permitted by both” the user and the task.
ISM-2159: tool calls, external requests and outputs “centrally logged with sufficient detail to support cyber security incident investigations”.

The other four: ISM-2134 keeps the register verified; ISM-2156 caps an agent at the minimum tools and permissions for its purpose; ISM-2158 keeps external content untrusted all the way through and bars it from overriding instructions, access controls or approval requirements (the prompt-injection control); ISM-2113, amended, now requires human approval before sensitive or high-impact actions rather than flagging them.

My read: “treat agents as users” was my gloss on ASD’s May paper, and September runs the other way: the agent gets its own identity, and older controls that said “users” now say “human users”. ASD has given the agent its own principal with user-grade discipline: identity, register line, ceiling, logs, human approval. The manual now needs an adjective to mean a person. (ISM-2157 says “the invoking user”, no adjective, in the same document that puts “human user” in thirty-seven other controls. I suspect that is deliberate: an agent calling an agent passes its ceiling down the chain. I have not asked ASD.)

ISM-2113 is the one I still think falls over at fifty agents (nobody reads the fiftieth approval prompt). My guess is most shops could not fill in ISM-2135’s last item, what their agents can reach.

Net: the ISM is not law. The security-mature end of the market copies it anyway, and this is the list they will copy.